Users page in Rancher cluster explorer randomly doesn't let you delete users, seems browser-based

[jbilliau-rcd]

SURE-9751

Setup

• Rancher version: 2.9.6
• Rancher UI Extensions: None
• Browser type & version: Chrome 132.0.6834.160

Describe the bug
When selecting a checkbox next to a user to delete, often times the delete button will be grayed out. You click on another user, works fine. These users are identical other than their names. If you refresh the browser, the grayed out delete button will then be clickable. This is me trying to checkbox a bunch of users to delete:

Some deleted, some remain:

1.) Bug doesn't seem to be data-related. 2 users have almost the exact same YAML other than stuff like ID's and timestamps, and yet one can delete, the other can't.

2.) Bug is "fixed" by going into the user, then going back to the users screen.

3.) bug doesn't appear to be data related since we had an incognito window open on the same users screen, and on the other tab went into a user and then back out. Clicking over to the incognito window, the user still wasn't deletable.

4.) However, on the same browser tab, clicking into the user and back out seemingly fixes it.

5.) This isn't an issue on cluster manager, the /g endpoint. Works flawlessly.

TL;DR - this appears to be a browser-based code issue in cluster explorer specifically.

To Reproduce

Try deleting a user that is generated from a SSO auth provider.

Result

Can't delete random users, seemingly no pattern I can see.

Expected Result
I should be able to delete any and all users, like cluster manager allows me to.

[richard-cox]

@jbilliau-rcd The UI will pick up additional RBAC features via the resource when it's returned by network request. For this page i think it's /v1/management.cattle.io.users and each applicable user should have a links.remove entry (even if it does have a value of blocked). Can you confirm the users received over http request have that property? They might also be overwritten by resources received over websocket (/v1/subscribe messages tab), those would also need the links.remove entry

[jbilliau-rcd]

so this is an example of a user whom the "delete" button isn't enabled for:

if I click INTO the user, I can menu > delete....I just can't via the checkbox on the main screen with all the users.

Also, I was instructed to make this issue from my support rep, Julio, case number 01565787. Just a FYI if it matters/helps.

[richard-cox]

if I click INTO the user, I can menu > delete....I just can't via the checkbox on the main screen with all the users.

Was there anything via websocket overwriting that resource?

I was instructed to make this issue from my support rep, Julio, case number 01565787

To confirm your company has paid for SUSE support for Rancher? If so please reach out to your SUSE CSM, there is another process to follow first before issues hit github. Feel free to contact me by dm in our public slack if you need help with that part (https://slack.rancher.io/), otherwise you would need to double check with your support provider.

[jbilliau-rcd]

To your first question, how would I check that?

To your second statement, I'll let Julio know; correct, I am a paying customer.

[richard-cox]

Thanks for the update @jbilliau-rcd , we've now aligned issues everywhere. Julio should be able to guide you through further triage (I think some additional questions were sent your way). Keep him updated and we'll track that info internally

[richard-cox]

More info can be find in jira, but briefly

• UI requires the norman user to determine if steve user can be deleted
• UI fetches norman users but doesn't supply a limit or depaginate, so only the first 1000 are fetched
• User in question is one of those missing, so UI doesn't show delete option
• When navigating to the user detail page though we explicetly get the norman user, so all delete options are available

Fixes

• Short term - set a sensible limit and depaginate the request to fetch norman users (there is a mechanism already for this via product config)
• Longer term - using PAPI + SSP to replace fetching all norman users

[jbilliau-rcd]

Finally, glad to see this is finally figured out! Any idea as to what version of Rancher we can expect this fix @richard-cox ?

[richard-cox]

@jbilliau-rcd Currently the change is targeted at 2.12.0, though it's best to discuss that part with your CSM